Examkin

Design Infrastructure Solutions

360 questions

All types360Multiple choice189Multiple select171
Question 21Question →

You are designing the container compute infrastructure for a new retail analytics platform. The platform includes the following two workloads:
- A message-processing service that reads tasks from an Azure Service Bus queue and must scale dynamically based on the queue depth, including scaling down to zero instances.
- A daily reporting job that aggregates transactional data, runs for up to three hours per execution, and must execute to completion.

You need to recommend a containerized hosting solution for both workloads. The solution must minimize administrative effort.

Which two Azure container hosting options should you recommend?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the message-processing service; Azure Container Apps Jobs to host the daily reporting job

Answer

Azure Container Apps to host the message-processing service and Azure Container Apps Jobs to host the daily reporting job.
The correct recommendation is to use Azure Container Apps to host the message-processing service and Azure Container Apps Jobs to host the daily reporting job. Azure Container Apps manages event-driven scaling (KEDA) and supports scaling to zero, satisfying the requirements of the message-processing service. Azure Container Apps Jobs provides a serverless execution environment designed for run-to-completion tasks, supporting long-running executions of up to 24 hours, which accommodates the three-hour daily reporting job. Both services are fully managed, meeting the goal of minimizing administrative effort.

Step-by-Step Solution

1
Analyze the scaling and operational requirements of the message-processing workload.
The service needs dynamic scaling based on queue depth (KEDA), scale-to-zero capabilities, and minimized administrative overhead.
This workload maps to Azure Container Apps, which handles event-driven scaling automatically under a fully managed serverless model.
2
Analyze the execution duration and lifecycle of the reporting workload.
The job is a daily, run-to-completion batch process that takes up to three hours.
Azure Container Apps Jobs is ideal for this since it supports executions lasting up to 24 hours without cluster management overhead.
3
Evaluate the administrative overhead of Azure Kubernetes Service (AKS).
AKS is rejected because it requires cluster, virtual machine node pool, and control plane management, failing the requirement to minimize administrative effort.
AKS is suitable when custom Kubernetes API access or deep control plane customization is needed, which is not required here.
4
Evaluate the execution constraints of Azure Functions Consumption plan.
Azure Functions on a Consumption plan is rejected because of its 10-minute timeout limit.
The daily reporting job runs for three hours, which exceeds the platform's hard limits.

Key Concept

Selecting the optimal Azure container hosting option based on scaling needs, execution duration, and administrative overhead constraints.
Question 22Question →

An organization is deploying a critical, steady-state production web application to Azure. The application requires continuous availability and a guaranteed service level agreement (SLA) with zero tolerance for unexpected virtual machine evictions or downtime. Which compute virtualization solution should you recommend?

Show answer & explanation

Answer: Standard Azure Virtual Machines

Answer

Standard Azure Virtual Machines
Standard Azure Virtual Machines provide the continuous availability, dedicated capacity, and Azure service level agreements (SLAs) required to support critical, steady-state production workloads without the risk of eviction.

Step-by-Step Solution

1
Analyze the workload requirements
The application is critical, steady-state, and requires continuous availability with a guaranteed SLA.
This rules out any options that allow virtual machine eviction or lack high availability guarantees.
2
Evaluate the hosting options against the requirements
Standard Azure Virtual Machines offer guaranteed capacity and SLA, meeting the production requirements, whereas Spot VMs are subject to eviction.
Choosing the compute type that guarantees continuous execution is necessary for production environments.

Key Concept

Selecting the appropriate Azure virtual machine hosting option based on workload stability, availability, and SLA requirements.
Question 23Question →

A financial services company is designing a new event-driven transaction reconciliation system. The system consists of 15 microservices that run as Docker containers and scale dynamically based on the volume of messages in an Azure Service Bus queue.

The design must meet the following requirements:
- Support event-driven autoscaling using Kubernetes Event-driven Autoscaling (KEDA) specifications.
- Minimize administrative effort by avoiding the provisioning, patching, and management of container clusters, nodes, or control planes.
- Ensure strict network isolation between the development and production environments by routing all egress traffic through a centralized Azure Firewall.
- Isolate production logs from development logs in separate storage repositories to meet regulatory compliance, while preventing administrative overhead associated with managing log workspaces.

Which container hosting and logging solution should you recommend?

Show answer & explanation

Answer: Deploy the microservices to two separate Azure Container Apps Environments (one for development and one for production) integrated with dedicated virtual networks. Configure virtual network routing to direct egress traffic through the central Azure Firewall, and associate each environment with a separate Log Analytics workspace.

Answer

Deploy the microservices to two separate Azure Container Apps Environments (one for development and one for production) integrated with dedicated virtual networks. Configure virtual network routing to direct egress traffic through the central Azure Firewall, and associate each environment with a separate Log Analytics workspace.
The correct design utilizes Azure Container Apps (ACA) because it is a serverless container platform that natively supports Kubernetes Event-driven Autoscaling (KEDA) scaling rules without the operational overhead of managing clusters, nodes, or control planes. To achieve strict network isolation, each environment is deployed into its own virtual network with custom route tables directing egress through the Azure Firewall. To satisfy regulatory logging compliance, separate Log Analytics workspaces are used for each Container Apps Environment, ensuring production data isolation while keeping management overhead low compared to managing a cluster-based logging agent configuration.

Step-by-Step Solution

1
Analyze compute and infrastructure management requirements.
Determine that the serverless requirement and the aversion to cluster/node provisioning rule out standard AKS, leading to Azure Container Apps (ACA) as the primary compute candidate.
ACA provides a fully managed, serverless container platform that automatically abstracts node management while supporting native KEDA-based scaling.
2
Evaluate network isolation and egress routing constraints.
Determine that a dual-environment virtual network configuration is required to separate development and production, allowing custom route tables to direct egress traffic through Azure Firewall.
Strict environment-level network boundaries cannot be securely maintained within a single Container Apps Environment or a single shared VNet without complex, error-prone configurations.
3
Assess the logging compliance and administrative overhead constraints.
Conclude that two separate Log Analytics workspaces must be deployed (one per Container Apps Environment).
This satisfies the regulatory segregation of production logs from development logs, while avoiding the overhead of managing a massive multi-workspace mesh or a single workspace that violates the compliance boundary.

Key Concept

Selecting the optimal container platform and isolation boundary under strict administrative, networking, and compliance constraints in Microsoft Azure.
Question 24Question →

A financial services company is designing a system to process payment transactions from an Azure Service Bus queue using containerized worker applications. The design must satisfy the following requirements:
- Scale the container instances dynamically from 00 to 100100 based on queue message depth.
- Support Kubernetes Event-driven Autoscaling (KEDA) natively without manual agent configuration.
- Minimize administrative effort and cluster management overhead.

Which Azure compute service should you recommend for the containerized worker applications?

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps should be recommended because it natively supports event-driven scaling using KEDA (including scaling to zero) while minimizing the operational and administrative effort of managing the underlying cluster infrastructure.
Azure Container Apps is the ideal solution because it is a serverless container hosting service that provides native support for Kubernetes Event-driven Autoscaling (KEDA). This allows the application to scale dynamically from zero to many instances based on queue depth, while completely removing the administrative overhead of managing Kubernetes control planes, node pools, or cluster maintenance.

Step-by-Step Solution

1
Analyze the requirements for container hosting, scaling behavior, and administrative effort constraints.
The workload requires dynamic scaling from 00 to 100100 instances based on queue depth using KEDA, and the team wants to minimize cluster management overhead.
This establishes the key criteria to evaluate against Azure container hosting options.
2
Evaluate the administrative overhead of the candidate services.
Azure Kubernetes Service (AKS) requires managing control planes and node pools, whereas Azure Container Apps (ACA) is a fully managed serverless platform that abstracts the underlying Kubernetes infrastructure.
To satisfy the requirement of minimizing administrative effort, a serverless or managed service is preferred over AKS.
3
Compare scaling capabilities of serverless container options.
Azure Container Apps natively supports KEDA for event-driven scaling and scaling down to zero. Azure Container Instances (ACI) and App Service do not natively support KEDA-based scaling.
This identifies the only service that fulfills both the KEDA auto-scaling requirement and the low administrative overhead goal.

Key Concept

Selecting Azure container hosting services based on scaling requirements (KEDA) and administrative overhead constraints.
Estimated Time:2m 0s
Question 25Question →

An organization plans to deploy a containerized order-processing application to Azure. The application must be deployed across two separate regions (East US and West US) to meet local data sovereignty requirements.

The solution must satisfy the following requirements:
- Support event-driven scaling of containers using KEDA.
- Minimize administrative and operational overhead.
- Ensure container logs do not cross regional boundaries.

Which two configurations should you recommend in the design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the application containers; A separate Log Analytics workspace in each deployment region

Answer

To meet the requirements, the design should include Azure Container Apps to host the application containers, and a separate Log Analytics workspace in each deployment region.
The correct options are using Azure Container Apps for hosting the containers and setting up a separate Log Analytics workspace in each region. Azure Container Apps provides serverless container hosting that natively supports event-driven scaling using KEDA while minimizing infrastructure management. Using a separate Log Analytics workspace in each region ensures that telemetry and console logs are kept within the respective geographical regions, complying with local data sovereignty requirements.

Step-by-Step Solution

1
Evaluate compute hosting requirements to minimize administrative overhead and support event-driven scaling with KEDA.
Azure Container Apps is selected because it is a serverless platform that supports KEDA scaling natively with lower administrative overhead than Azure Kubernetes Service.
Azure Kubernetes Service requires cluster management and configuration, which increases operational effort.
2
Evaluate logging requirements to ensure compliance with regional data sovereignty limits.
Separate Log Analytics workspaces are selected in East US and West US.
A single centralized workspace would route logs across regional boundaries, violating the requirement to keep logs locally within the region.

Key Concept

Selecting container hosting and monitoring strategies in Azure based on scaling, administrative overhead, and regional compliance requirements.
Estimated Time:1m 0s
Question 26Question →

A company is planning to deploy two workloads on Azure Virtual Machines:
1. A batch processing job that runs nightly, can be interrupted at any time, and requires minimal costs.
2. A critical customer-facing API that must run continuously with a 99.9% uptime SLA.

Which two of the following virtual machine deployment strategies should you recommend to meet these requirements while minimizing costs? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy the nightly batch processing job on Azure Spot Virtual Machines.; Deploy the customer-facing API on standard Azure Virtual Machines distributed across multiple Availability Zones.

Answer

Deploy the nightly batch processing job on Azure Spot Virtual Machines, and deploy the customer-facing API on standard Azure Virtual Machines distributed across multiple Availability Zones.
Deploying the batch processing job on Spot Virtual Machines leverages idle Azure capacity at deep discounts, which is ideal because the workload can tolerate interruptions. Deploying the customer-facing API on standard Virtual Machines across multiple Availability Zones ensures that the production workload meets its 99.9% uptime SLA and remains highly available.

Step-by-Step Solution

1
Analyze the requirements for the nightly batch processing workload.
The workload is non-critical, can tolerate interruptions, and must be highly cost-optimized. This makes it a perfect fit for Azure Spot VMs.
Spot VMs offer up to 90% cost savings compared to pay-as-you-go rates in exchange for the risk of eviction.
2
Analyze the requirements for the customer-facing API.
The API is critical, must run continuously, and requires a 99.9% SLA, which rules out Spot VMs.
Production workloads with strict SLAs require standard VMs with guaranteed runtimes.
3
Identify the high availability solution for the API VM deployment.
Deploying the standard VMs across multiple Availability Zones ensures protection against datacenter failures and meets the high availability SLA.
A single Availability Zone deployment does not protect against localized zone failures.

Key Concept

Selecting VM offerings and redundancy levels based on workload SLA and cost constraints.
Question 27Question →

A healthcare provider plans to migrate a legacy patient records system to Azure. The system must run on dedicated physical servers that host only this provider's workloads to comply with strict regulatory isolation requirements. The workload is critical and cannot tolerate eviction or interruption. Which Azure compute virtualization solution should you recommend?

Show answer & explanation

Answer: Azure Dedicated Hosts

Answer

Azure Dedicated Hosts
Azure Dedicated Hosts provides physical servers that are dedicated to a single Azure subscription. This ensures that no other tenant's virtual machines run on the same physical hardware, satisfying regulatory compliance requirements, while ensuring the host does not have eviction risks.

Step-by-Step Solution

1
Analyze the isolation requirement
The requirement states that the physical servers must only host the workloads of a single customer.
This rules out multi-tenant Azure virtual machine hosting options.
2
Evaluate the workload reliability requirements
The legacy system is critical and cannot tolerate eviction or interruption.
This rules out options that introduce eviction risk, such as Spot VMs.
3
Select the correct compute hosting solution
Azure Dedicated Hosts provides physical servers dedicated to one Azure subscription, ensuring physical isolation and steady-state reliability.
It satisfies both the regulatory isolation and the continuous availability requirements.

Key Concept

Azure Dedicated Hosts provides hardware-level physical isolation for virtualized workloads.
Question 28Question →

You are designing a routing solution for an Azure environment to meet corporate security compliance. The environment contains a virtual network named `vnet-prod-spoke` with an address space of 10.10.0.0/1610.10.0.0/16.

To ensure security inspection, all outbound traffic destined for the internet must be redirected to an on-premises VPN gateway, while virtual machines within `vnet-prod-spoke` must be able to communicate directly with one another.

You create a custom route table and associate it with the subnets in `vnet-prod-spoke`.

Which route configuration should you add to the route table to meet these requirements?

Show answer & explanation

Answer: A route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual Network Gateway.

Answer

A route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual Network Gateway.
The correct configuration is a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual Network Gateway. Under Azure's routing rules, the longest prefix match determines which route is selected. Since the virtual network's default system route of 10.10.0.0/1610.10.0.0/16 is more specific than the default route 0.0.0.0/00.0.0.0/0, traffic destined for resources inside the virtual network will be routed locally, while all other traffic (internet-bound) will be forwarded to the Virtual Network Gateway.

Step-by-Step Solution

1
Identify the target prefix for all internet-bound traffic.
The target prefix representing all destinations outside the virtual network (the default route) is 0.0.0.0/00.0.0.0/0.
Redirection of all internet traffic requires a default route that matches any destination not covered by more specific routes.
2
Determine the next hop type to direct traffic to the on-premises network.
The next hop type must be set to Virtual Network Gateway.
A VPN gateway or ExpressRoute gateway is represented in Azure routing tables by the Virtual Network Gateway next hop type.
3
Analyze the impact on local traffic routing.
Local traffic within `vnet-prod-spoke` matches the system-defined local route (10.10.0.0/1610.10.0.0/16 -> Local). Since 10.10.0.0/1610.10.0.0/16 is a longer (more specific) prefix than 0.0.0.0/00.0.0.0/0, Azure will prioritize the local route for internal communication.
Azure routing logic always uses the longest prefix match (LPM) to select the route, so no additional route is needed for local traffic.

Key Concept

Azure uses the longest prefix match (LPM) algorithm to select routes. A user-defined route (UDR) for a broad prefix like 0.0.0.0/00.0.0.0/0 does not override more specific system routes, such as the local virtual network route.
Question 29Question →

A logistics company is designing a hosting solution for a new containerized web API. The API is packaged as a single Docker container. The workload must support scaling down to zero instances when idle to minimize costs, and the solution must require the lowest administrative overhead. Which service should you recommend?

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps
Azure Container Apps is the ideal solution because it provides a serverless platform designed for containerized microservices and APIs. It allows scaling down to zero instances during idle periods to eliminate compute costs, while removing the administrative burden of provisioning and managing clusters or virtual machines.

Step-by-Step Solution

1
Analyze the workload requirements
The application is a single containerized web API that requires request-driven scaling (including scaling to zero) and must be managed with minimal administrative effort.
Understanding the scaling pattern and management constraints helps narrow down the appropriate Azure container hosting options.
2
Evaluate Azure container hosting services against requirements
Azure Container Apps provides serverless container hosting, request-based scaling to zero, and low administrative overhead. Azure Kubernetes Service (AKS) requires cluster management and has high overhead. Azure Virtual Machines with Spot VMs cannot guarantee availability and do not scale to zero natively. Azure Functions introduces execution timeout limitations and code modification overhead.
Comparing the capabilities of each candidate service ensures the selected solution satisfies all design constraints.

Key Concept

Selecting the appropriate Azure container hosting service based on scaling requirements and administrative overhead
Question 30Question →

An enterprise is designing a container-based ingestion and processing solution for healthcare telemetry data. The telemetry is ingested in two distinct geographical regions: East US and West US. The design must accommodate the following requirements:

- Workload 1: A lightweight microservice that processes telemetry messages from an Azure Service Bus queue. The workload must support event-driven scaling using KEDA, including scaling to zero instances when no messages are present, while minimizing infrastructure management overhead.
- Workload 2: A batch processing job that runs model training algorithms. The job requires custom access to the underlying Kubernetes API to orchestrate child pods across dedicated, physically isolated compute nodes.
- Logging: Container logs from the East US and West US regions must be kept strictly segregated within their respective geographical boundaries to comply with local healthcare privacy and data residency laws.

Which three design decisions should you recommend?

Select all that apply

Show answer & explanation

Answer: Deploy Workload 1 to Azure Container Apps.; Deploy Workload 2 to Azure Kubernetes Service (AKS).; Provision two separate regional Log Analytics workspaces to store container logs.

Answer

Deploy Workload 1 to Azure Container Apps, deploy Workload 2 to Azure Kubernetes Service (AKS), and provision two separate regional Log Analytics workspaces.
The correct design decisions are to deploy Workload 1 to Azure Container Apps, deploy Workload 2 to Azure Kubernetes Service (AKS), and provision two separate regional Log Analytics workspaces. Azure Container Apps is optimized for microservices requiring event-driven scaling (KEDA) and scaling to zero without the administrative overhead of managing clusters. Azure Kubernetes Service (AKS) is required for Workload 2 because it exposes direct access to the Kubernetes API for pod orchestration and supports dedicated physical hosts for compute isolation. Separate regional Log Analytics workspaces are necessary to satisfy strict regional data residency and isolation compliance requirements, preventing cross-region log replication.

Step-by-Step Solution

1
Analyze requirements for Workload 1.
Workload 1 needs event-driven scaling (KEDA), scale-to-zero capability, and minimal administrative overhead.
Azure Container Apps natively supports KEDA and scaling to zero without the overhead of cluster management, making it the best fit.
2
Analyze requirements for Workload 2.
Workload 2 requires direct access to the Kubernetes API and physical isolation on dedicated hosts.
Azure Kubernetes Service (AKS) supports dedicated hosts and exposes the Kubernetes API, whereas Azure Container Apps abstracts the control plane and does not allow Kubernetes API access.
3
Analyze regional compliance and data residency requirements.
Logs from East US and West US must be kept strictly segregated within their geographical boundaries.
Two separate regional Log Analytics workspaces must be provisioned to ensure data residency compliance, avoiding a single centralized workspace.

Key Concept

Selecting container hosting solutions (Azure Container Apps vs. Azure Kubernetes Service) based on scaling, API access, and infrastructure overhead constraints, combined with regional log segregation for compliance.
Estimated Time:3m 0s
Question 31Question →

A digital health platform is designing a containerized microservice-based architecture to process patient data in two regions: North Europe (Ireland) and West Europe (Netherlands). The platform has the following requirements:
- The microservices must scale dynamically from zero based on HTTP traffic and message queue depth.
- You must minimize the administrative effort required to manage container orchestration, patching, and OS maintenance.
- For compliance and data sovereignty reasons, application log data from the Irish region must be strictly segregated at the data-plane level and stored within Ireland, while Netherlands log data must remain within the Netherlands.

Which two configurations should you recommend to meet the requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Host the microservices on Azure Container Apps; Provision separate Azure Log Analytics workspaces in the North Europe and West Europe regions

Answer

Host the microservices on Azure Container Apps, and provision separate Azure Log Analytics workspaces in the North Europe and West Europe regions.
Hosting the microservices on Azure Container Apps meets the requirements of running containerized workloads, scaling from zero, and supporting KEDA out-of-the-box while minimizing administrative overhead by using a fully managed serverless platform. Provisioning separate Log Analytics workspaces in the North Europe and West Europe regions ensures compliance with strict data sovereignty and log isolation requirements between the two regions.

Step-by-Step Solution

1
Evaluate the compute options based on administrative effort and autoscaling requirements.
Azure Container Apps is selected because it is a serverless platform that supports event-driven scaling natively and minimizes administrative overhead compared to AKS, which requires manual node and cluster management.
The scenario requires minimizing administrative effort while supporting container scaling based on HTTP traffic and queue depth.
2
Evaluate the monitoring and compliance requirements for log data residency.
Separate Log Analytics workspaces must be deployed in each region (North Europe and West Europe).
Compliance and data sovereignty demand that log data from Ireland and the Netherlands be physically segregated and stored in their respective regions.

Key Concept

Selecting container hosting platforms and designing regional monitoring architectures based on operational overhead and compliance requirements.
Estimated Time:3m 0s
Question 32Question →

An enterprise is designing a container-based application on Azure. The application consists of two workloads:

* Workload 1: An API gateway that requires custom Kubernetes Custom Resource Definitions (CRDs) and direct access to the Kubernetes control plane API.
* Workload 2: A queue processing service that scales dynamically based on the count of active messages in an Azure Service Bus queue.

The solution must minimize administrative overhead for Workload 2.

Which two services should you recommend? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Kubernetes Service (AKS) for Workload 1; Azure Container Apps for Workload 2

Answer

The correct answers are the options recommending Azure Kubernetes Service (AKS) for Workload 1 and Azure Container Apps for Workload 2.
Azure Kubernetes Service (AKS) is the correct choice for Workload 1 because it provides full access to the Kubernetes control plane API and supports custom Custom Resource Definitions (CRDs). Azure Container Apps is the correct choice for Workload 2 because it natively integrates with KEDA (Kubernetes Event-driven Autoscaling) to scale dynamically based on Azure Service Bus queue length, while minimizing administrative overhead by operating as a serverless container platform.

Step-by-Step Solution

1
Analyze the technical requirements of Workload 1.
Workload 1 requires custom Kubernetes CRDs and direct control plane API access.
These requirements dictate a hosting service that exposes full Kubernetes management capabilities.
2
Compare Azure Kubernetes Service (AKS) and Azure Container Apps (ACA) against the requirements of Workload 1.
Only AKS supports custom CRDs and direct API access, whereas ACA abstracts the control plane and does not support these features.
This identifies the correct compute solution for the first workload.
3
Analyze the requirements and administrative constraints of Workload 2.
Workload 2 requires queue-based autoscaling (KEDA) and must minimize administrative effort.
This helps choose between a serverless container service (ACA) and a fully managed Kubernetes cluster (AKS).
4
Evaluate hosting options for Workload 2.
Azure Container Apps provides built-in KEDA scaling and serverless management, whereas AKS introduces high administrative overhead and ACI lacks native queue-based scaling.
This determines the best hosting service that satisfies both the technical and operational constraints.

Key Concept

Selecting container hosting services based on Kubernetes API access requirements and administrative overhead constraints.
Question 33Question →

A company plans to deploy a new public-facing web application on Azure Virtual Machines. The application will run steady-state, predictable workloads 24/7 and requires a guaranteed availability SLA of 99.99%. Which two virtual machine configurations or options should you select to meet these requirements while optimizing costs? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Reserved Virtual Machine Instances to reduce compute costs for the predictable workload.; Azure Virtual Machines deployed across multiple Availability Zones to meet the 99.99% availability SLA.

Answer

Select Azure Reserved Virtual Machine Instances to reduce compute costs for the predictable workload, and deploy Azure Virtual Machines across multiple Availability Zones to meet the 99.99% availability SLA.
Azure Reserved Virtual Machine Instances are ideal for steady-state workloads running continuously, as they offer significant discounts for a committed term. To achieve the 99.99% availability SLA, Azure requires virtual machines to be deployed across multiple Availability Zones in a region.

Step-by-Step Solution

1
Analyze the availability requirement.
The application requires a 99.99% availability SLA.
Azure guarantees a 99.99% uptime SLA for virtual machines only when two or more instances are deployed across two or more Availability Zones in the same region.
2
Analyze the cost optimization requirement for a 24/7 steady-state workload.
Azure Reserved Virtual Machine Instances (RIs) should be used.
Reserved Instances allow you to commit to a one-year or three-year plan, providing deep discounts for predictable, continuous compute workloads.
3
Evaluate and rule out incorrect options based on constraints.
Spot VMs and single zone deployments are ruled out.
Spot VMs can be evicted at any time and offer no SLA, making them unsuitable for production workloads. A single zone deployment cannot provide the 99.99% availability SLA.

Key Concept

Designing high-availability and cost-optimized virtual machine solutions using Availability Zones and Reserved Instances.
Question 34Question →

A LegalTech company is designing a document indexing and analysis solution on Azure. The architecture must satisfy the following requirements:
- Process uploaded PDF agreements using a custom containerized parser that dynamically scales from zero based on the number of messages in an Azure Storage queue.
- Provide a containerized HTTP API front-end to receive document upload metadata.
- Run all containers on a platform that minimizes operational and infrastructure management overhead.
- Support event-driven autoscaling using KEDA natively without managing virtual machine nodes or Kubernetes control planes.
- Ensure all components are deployed securely with private IP addresses within an Azure Virtual Network.

Which compute solution should you recommend for hosting the containerized parser?

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps is the recommended solution because it provides a serverless environment that natively integrates with KEDA for event-driven autoscaling (including scaling to zero), supports deployment into an internal Virtual Network, and eliminates the administrative overhead associated with managing Kubernetes clusters.
The correct answer is Azure Container Apps because it provides a serverless container hosting environment that completely abstracts cluster management. It natively supports event-driven scaling using KEDA, allowing containers to scale to zero when the Azure Storage queue is empty. Furthermore, it supports deployment into an internal Azure Virtual Network, meeting all security and connectivity criteria with minimal operational overhead.

Step-by-Step Solution

1
Analyze the operational constraints
The solution must minimize administrative effort, ruling out solutions that require managing cluster control planes or virtual machine nodes.
This requirement differentiates managed Kubernetes environments from serverless container services.
2
Evaluate autoscaling requirements
The platform must support event-driven scaling using KEDA natively, specifically scaling from and to zero instances based on Azure Storage Queue length.
This rules out standard container instances or web apps that lack native KEDA scaling hooks.
3
Evaluate network isolation requirements
The platform must support deployment within an Azure Virtual Network with private IP addresses.
Both Azure Kubernetes Service and Azure Container Apps support internal virtual network environments, but Azure Container Apps achieves this with much lower operational overhead.

Key Concept

Selecting container compute solutions based on operational overhead and native scaling mechanisms
Question 35Question →

An enterprise designs a hub-and-spoke virtual network topology in Azure to connect cloud workloads with their on-premises datacenter. The hub virtual network, `vnet-hub-core` (10.100.0.0/1610.100.0.0/16), contains an Azure Firewall deployed at 10.100.4.410.100.4.4 and an ExpressRoute virtual network gateway. The spoke virtual network, `vnet-spoke-prod` (10.110.0.0/1610.110.0.0/16), contains a subnet named `snet-app` (10.110.1.0/2410.110.1.0/24). Virtual network peering is established between `vnet-hub-core` and `vnet-spoke-prod` with gateway transit enabled. The ExpressRoute gateway dynamically learns the on-premises database subnet prefix 172.20.100.0/24172.20.100.0/24 and the summary prefix 172.16.0.0/12172.16.0.0/12 via BGP. A custom Route Table is associated with `snet-app` and has gateway route propagation enabled. To ensure all traffic to the on-premises environment is inspected by the firewall, a User-Defined Route (UDR) is added with a destination prefix of 172.16.0.0/12172.16.0.0/12 and next hop address of 10.100.4.410.100.4.4. During auditing, network administrators discover that traffic destined for the database servers at 172.20.100.50172.20.100.50 bypasses the Azure Firewall and is sent directly to the ExpressRoute gateway. Which of the following explains this behavior?

Show answer & explanation

Answer: The dynamically learned BGP route for 172.20.100.0/24172.20.100.0/24 has a longer prefix match than the User-Defined Route for 172.16.0.0/12172.16.0.0/12, causing Azure to prioritize the BGP route.

Answer

The dynamically learned BGP route for 172.20.100.0/24172.20.100.0/24 has a longer prefix match than the User-Defined Route for 172.16.0.0/12172.16.0.0/12, causing Azure to prioritize the BGP route.
In Azure routing, Longest Prefix Match (LPM) is the primary algorithm used to select a route. The destination IP 172.20.100.50172.20.100.50 matches both the User-Defined Route (172.16.0.0/12172.16.0.0/12) and the BGP-learned route (172.20.100.0/24172.20.100.0/24). Because the BGP route has a longer prefix length (/24 vs. /12), Azure selects it. The rule where UDRs take precedence over BGP is only applied as a tie-breaker when the prefix lengths are identical.

Step-by-Step Solution

1
Analyze the destination IP address of the database traffic.
The destination is 172.20.100.50172.20.100.50, which matches both the UDR prefix 172.16.0.0/12172.16.0.0/12 and the BGP prefix 172.20.100.0/24172.20.100.0/24.
Identifying all matching routes in the subnet's routing table is the first step in determining path selection.
2
Evaluate the routes based on Azure's Longest Prefix Match (LPM) rule.
The prefix 172.20.100.0/24172.20.100.0/24 has a length of 24, which is longer (more specific) than the UDR prefix 172.16.0.0/12172.16.0.0/12 with a length of 12.
Azure always evaluates prefix length first; a longer prefix match takes precedence over any other route selection criteria, including route source type.
3
Determine the routing outcome.
Azure selects the /24 BGP route, directing traffic directly to the ExpressRoute gateway and bypassing the firewall next hop specified in the /12 UDR.
This explains the bypass behavior observed by the network administrators.

Key Concept

Azure route selection order and Longest Prefix Match (LPM)
Question 36Question →

An enterprise designs a hub-and-spoke network topology in Azure. The topology consists of:
- A hub virtual network named `vnet-weur-hub` (10.100.0.0/1610.100.0.0/16) containing an Azure Firewall with the private IP address 10.100.4.410.100.4.4.
- A spoke virtual network named `vnet-weur-spoke1` (10.101.0.0/1610.101.0.0/16) that contains a subnet named `snet-workload1` (10.101.1.0/2410.101.1.0/24).
- A spoke virtual network named `vnet-weur-spoke2` (10.102.0.0/1610.102.0.0/16) that contains a subnet named `snet-workload2` (10.102.1.0/2410.102.1.0/24).

Both spoke virtual networks are peered directly with the hub virtual network. The security team requires that all traffic destined for the internet and all traffic between the two spoke virtual networks must be routed through the Azure Firewall in the hub. However, traffic between resources within `vnet-weur-spoke1` must remain local and route directly without passing through the firewall.

You need to design a route table for `snet-workload1` that meets these requirements with the minimum number of user-defined routes (UDRs).

Which route configuration should you specify in the route table?

Show answer & explanation

Answer: A single route with the address prefix 0.0.0.0/0, next hop type Virtual Appliance, and next hop address 10.100.4.4

Answer

A single route with the address prefix 0.0.0.0/0, next hop type Virtual Appliance, and next hop address 10.100.4.4
The correct configuration uses a single route with the prefix 0.0.0.0/0 pointing to the Azure Firewall at 10.100.4.4. Since Azure uses the longest prefix match algorithm, traffic to the local network (10.101.0.0/16) will match the system route and bypass the firewall, whereas inter-spoke and internet traffic will match the default route and go through the firewall.

Step-by-Step Solution

1
Analyze the prefix matching behavior of Azure routing.
Azure evaluates routing tables using the longest prefix match. The system route for the local virtual network is 10.101.0.0/16.
Understanding how Azure determines path priority is necessary to avoid unnecessary routes.
2
Evaluate the default route (0.0.0.0/0) behavior.
A UDR of 0.0.0.0/0 redirects all traffic not matching a more specific route to the specified next hop (10.100.4.4). Local traffic (10.101.0.0/16) remains direct because 16 is a longer prefix match than 0.
Using 0.0.0.0/0 minimizes the route table complexity while capturing internet and inter-spoke traffic.
3
Determine if additional routes are required for local VNet traffic.
No additional route is required. Adding a local VNet prefix route to the UDR table would override the direct path and force local traffic through the firewall.
This avoids the overlapping route misconception that breaks local VNet traffic.

Key Concept

Azure routing utilizes the longest prefix match algorithm, allowing broad User Defined Routes like 0.0.0.0/0 to redirect external traffic to virtual appliances without overriding more specific local system routes.

Alternative Method

While configuring a single 0.0.0.0/0 route is the most optimal approach, an alternative but more complex configuration would involve defining separate routes for internet-bound traffic (0.0.0.0/0) and spoke-bound traffic (10.102.0.0/16) both pointing to the firewall. This achieves the same routing logic but requires maintaining additional routes.
Estimated Time:1m 30s
Question 37Question →

An organization is designing the Azure container compute infrastructure for two new applications:

* Application 1 is a simple, public-facing microservice that experiences highly variable traffic. It must scale to zero when idle and minimize administrative effort.
* Application 2 is a stateful data processing engine that must run continuously and requires direct access to the Kubernetes API to manage Custom Resource Definitions (CRDs).

Which two services should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps for Application 1; Azure Kubernetes Service (AKS) for Application 2

Answer

To host Application 1, recommend Azure Container Apps to minimize administrative effort and support scaling to zero. For Application 2, recommend Azure Kubernetes Service (AKS) to provide direct access to the Kubernetes API for Custom Resource Definitions (CRDs).
The correct recommendation is to use Azure Container Apps for the first application and Azure Kubernetes Service (AKS) for the second application. Azure Container Apps is designed for microservices, scaling to zero, and low administrative effort. Azure Kubernetes Service is necessary when direct access to the Kubernetes control plane or API (such as for CRDs) is required.

Step-by-Step Solution

1
Identify requirements for Application 1.
Application 1 requires a simple microservice host, scaling to zero, and minimal administrative effort.
Establishing application requirements determines the necessary level of control and orchestration.
2
Select container service for Application 1.
Recommend Azure Container Apps.
Azure Container Apps abstracts Kubernetes management, reducing overhead while supporting scale-to-zero microservices.
3
Identify requirements for Application 2.
Application 2 requires direct access to the Kubernetes API to manage Custom Resource Definitions (CRDs).
Direct access to the API plane limits hosting choices to options that expose Kubernetes controls.
4
Select container service for Application 2.
Recommend Azure Kubernetes Service (AKS).
AKS provides full access to the Kubernetes API control plane, which is required for custom CRDs, unlike serverless abstractions like Azure Container Apps.

Key Concept

Differentiating container hosting options in Azure based on operational overhead and Kubernetes API access requirements.
Question 38Question →

A retail company is designing an order processing system that runs containerized workloads. The system must process orders from an Azure Service Bus queue. The workload has the following requirements:
- Process batches of orders that can take up to 15 minutes to complete per batch.
- Scale dynamically from zero to hundreds of instances based on the volume of messages in the queue.
- Support Kubernetes Event-driven Autoscaling (KEDA) natively.
- Minimize the administrative and operational effort required to manage infrastructure, VM patching, and container orchestration.

Which Azure service should you recommend hosting the containerized order processing workload?

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps
Azure Container Apps is a serverless container platform that natively integrates with KEDA (Kubernetes Event-driven Autoscaling). It allows containers to scale dynamically based on Azure Service Bus queue metrics, including scaling down to zero instances when no messages are present. It abstracts away the Kubernetes cluster management, node patching, and infrastructure maintenance, thereby minimizing operational overhead. Additionally, Azure Container Apps supports long-running execution limits that accommodate the 15-minute processing window.

Step-by-Step Solution

1
Analyze the scaling and execution requirements
The application runs in containers, needs to scale from zero to hundreds based on queue metrics using KEDA, and has a processing runtime limit of 15 minutes.
This establishes the technical constraints for hosting candidate options.
2
Evaluate the administrative overhead constraint
Azure Kubernetes Service is eliminated due to its high management overhead for node maintenance, upgrades, and clustering.
The scenario explicitly requests minimizing administrative and operational effort.
3
Evaluate the execution timeout constraint
Azure Functions on a Consumption plan is eliminated because it enforces a hard 10-minute timeout.
The workload requires up to 15 minutes of execution time per batch.
4
Evaluate native scaling support
Azure Container Instances is eliminated as it lacks native KEDA event-driven scaling to zero.
ACI would require custom scripts or helper utilities to monitor the queue and trigger instances.
5
Determine the best fit
Azure Container Apps provides serverless container management, native KEDA integrations, scale-to-zero capabilities, and supports container runtime limits that accommodate the 15-minute window.
Azure Container Apps meets all criteria with the lowest administrative overhead.

Key Concept

Selecting the appropriate Azure container hosting service based on scaling requirements, timeout constraints, and operational overhead.
Question 39Question →

An enterprise environment uses a hub-and-spoke topology. The hub virtual network is `vnet-hub-prod` (address space 10.1.0.0/1610.1.0.0/16) and hosts a network virtual appliance (NVA) at 10.1.0.410.1.0.4. Two spoke virtual networks are peered only to the hub: `vnet-spoke-web` (address space 10.2.0.0/1610.2.0.0/16) and `vnet-spoke-data` (address space 10.3.0.0/1610.3.0.0/16). You need to route all traffic between the two spokes through the NVA without overriding the default routing for communication within each spoke's own address space. Which two configurations should you implement?

Select all that apply

Show answer & explanation

Answer: In the route table associated with the subnets in `vnet-spoke-web`, add a route for 10.3.0.0/1610.3.0.0/16 with a next hop of Virtual Appliance at 10.1.0.410.1.0.4.; In the route table associated with the subnets in `vnet-spoke-data`, add a route for 10.2.0.0/1610.2.0.0/16 with a next hop of Virtual Appliance at 10.1.0.410.1.0.4.

Answer

To route inter-spoke traffic through the NVA, you must add a route for the remote spoke's address prefix (10.3.0.0/1610.3.0.0/16 in the web spoke, and 10.2.0.0/1610.2.0.0/16 in the data spoke) with a next hop pointing to the NVA's IP address. You must avoid creating user-defined routes for a spoke's own local address prefix, as doing so overrides the default system route for the local virtual network and disrupts internal communication.
To route transit traffic between the two spoke virtual networks through the NVA, you must define routes for the non-local spoke prefixes. Thus, the route table for the web spoke needs a route for the database spoke prefix (10.3.0.0/1610.3.0.0/16), and the route table for the database spoke needs a route for the web spoke prefix (10.2.0.0/1610.2.0.0/16). Both routes must point to the NVA's IP address at 10.1.0.410.1.0.4. This setup ensures that inter-spoke traffic is routed through the NVA, while local traffic within each spoke is handled by the default system route.

Step-by-Step Solution

1
Identify the target address prefix for outbound inter-spoke traffic originating from the web spoke.
The target prefix is the database spoke's address space: 10.3.0.0/1610.3.0.0/16.
This target prefix is used to steer traffic destined for the other spoke towards the NVA.
2
Identify the target address prefix for outbound inter-spoke traffic originating from the database spoke.
The target prefix is the web spoke's address space: 10.2.0.0/1610.2.0.0/16.
This target prefix is used to steer traffic returning or originating from the database spoke towards the NVA.
3
Configure the next hop type and IP address for both route definitions.
The next hop type is set to Virtual Appliance, and the next hop IP address is set to 10.1.0.410.1.0.4.
This directs traffic to the NVA hosted in the hub virtual network instead of using default direct routing.

Key Concept

User-Defined Routes and Default System Route Overrides
Question 40Question →

A retail company is designing a container-based backend system for real-time inventory updates. The system consists of multiple microservices that process messages from Azure Service Bus queues. The solution must meet the following requirements:
- Scale container instances down to zero when there are no messages in the queue to minimize costs.
- Support event-driven auto-scaling based on the number of messages in the Service Bus queues.
- Prevent developers from managing Kubernetes APIs, control planes, or virtual machine node scaling.
- Consolidate application telemetry into a single repository, while strictly isolating sensitive transaction logs into a separate, dedicated repository for regulatory compliance.

Which architecture should you recommend to meet the requirements with the minimum amount of administrative effort?

Show answer & explanation

Answer: Deploy the microservices to Azure Container Apps. Configure the container apps to write telemetry to a shared Log Analytics workspace, and route transaction logs to a dedicated Log Analytics workspace.

Answer

Deploy the microservices to Azure Container Apps. Configure the container apps to write telemetry to a shared Log Analytics workspace, and route transaction logs to a dedicated Log Analytics workspace.
The correct solution uses Azure Container Apps to host the microservices. This satisfies the event-driven scaling (via KEDA integration) and scale-to-zero requirements while completely abstracting the Kubernetes control plane and VM node scaling. To meet the compliance requirement, the solution isolates sensitive transaction logs into a dedicated Log Analytics workspace, keeping general application telemetry in a shared workspace.

Step-by-Step Solution

1
Evaluate the compute hosting requirements against Azure options.
Azure Container Apps (ACA) is selected over Azure Kubernetes Service (AKS) because it is a serverless platform that natively supports KEDA-based scaling, scales to zero, and hides Kubernetes API/infrastructure management, which directly minimizes administrative effort.
The requirements state that developer management of Kubernetes APIs, control planes, and VM node scaling must be prevented, which rules out AKS.
2
Evaluate the logging and compliance requirements.
Two distinct Log Analytics workspaces are planned: one shared workspace for telemetry logs and one dedicated workspace for sensitive transaction logs.
Regulatory compliance mandates strict isolation of transaction logs from application telemetry, which cannot be achieved with a single consolidated workspace.
3
Synthesize compute and logging designs into a unified solution.
Recommend hosting the microservices on Azure Container Apps and configuring log split routing to two separate Log Analytics workspaces.
This combined architecture satisfies all business, technical, scaling, and compliance requirements with the lowest operational overhead.

Key Concept

Azure Container Apps provides serverless container hosting with native KEDA-based scaling and zero operational overhead compared to AKS, while log isolation requirements must be met by using separate Log Analytics workspaces.
PreviousPage 2 / 18Next
Design Infrastructure Solutions Practice Questions — Microsoft Azure Solutions Architect (AZ-305) — Page 2 | Examkin